J-Magic: The Unseen Router Menace Slinking Through Key Sectors
Someone’s been slipping a backdoor, known as J-magic, into Juniper routers worldwide, focusing on sectors like semiconductors and energy. This covert operation waits for “magic packet” sequences to give hackers remote control. While Juniper remains tight-lipped, Black Lotus Labs uncovered this sinister tradecraft targeting routers as VPN gateways.
Hot Take:
Looks like someone’s trying to play the ultimate game of hide and seek with Juniper routers, but instead of a friendly “Gotcha!” it’s more of a “You’ve been compromised!”
Key Points:
- Juniper routers in key sectors have been backdoored since mid-2023 with a variant of the cd00r backdoor.
- The backdoor, dubbed J-magic, is memory-resident and waits for specific network packets to activate.
- Black Lotus Labs discovered the malware on VirusTotal and noted it uses a sophisticated RSA challenge to verify senders.
- The infected routers are primarily configured as VPN gateways, with some also having exposed NETCONF ports.
- Victims span several countries and industries, suggesting targeted attacks on critical infrastructure.
Already a member? Log in here